Log timestamps are a few hours off (they are UTC)

Every once in a while a customer asks how to "fix" the timestamps in the log files, because they are a few hours ahead of, or behind, the clock on the wall.

They are neither ahead nor behind: they are in UTC (Coordinated Universal Time), and that is not an arbitrary choice. The W3C Extended Log File Format specification states that the timestamp must refer to GMT without any daylight saving bias, which is UTC for short. Every log analysis product is built with that in mind and converts the timestamps to the time zone of the machine that runs the analysis when it produces its reports.

Which encoding to use

The Logging page of the Admin UI, when the destination is File, lets you choose the Encoding of the log records: JSON (one JSON object per line) or W3C. Both are supported, and both write UTC timestamps.

Use JSON. The JSON encoding carries every field of a record by name, is what modern log pipelines expect, and is the only encoding that supports the tamper evident log chain (the HMAC signature of each line, enabled with the tamper evident passphrase on the same page). The W3C encoding is kept for compatibility with older analyzers and is strongly discouraged for new deployments.